함수 단위 N-gram 비교를 통한 Spectre 공격 바이너리 식별 방법
Detecting Spectre Malware Binary through Function Level N-gram Comparison
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
시그니처 기반 악성코드 탐지는 제로데이 취약점을 이용하거나 변형된 악성코드를 탐지하지 못하는 한계가 있다. 이를 극복하기 위해 N-gram을 이용하여 악성코드를 분류하는 연구들이 활발히 수행되고 있다. 기존 연구들은 높은정확도로 악성코드를 분류할 수 있지만, Spectre와 같이 짧은 코드로 동작하는 악성코드는 식별하기 어렵다. 따라서 본 논문에서는 Spectre 공격 바이너리를 효과적으로 식별할 수 있도록 함수 단위 N-gram 비교 알고리즘을 제안한다. 본 알고리즘의 유효성을 판단하기 위해 165개의 정상 바이너리와 25개의 악성 바이너리에서 추출한N-gram 데이터셋을 Random Forest 모델로 학습했다. 모델 성능 실험 결과, 25개의 Spectre 악성 함수의 바이너리를 99.99% 정확도로 식별했으며, f1-score는 92%로 나타났다.
Abstract
Signature-based malicious code detection methods share a common limitation; it is very hard to detect modified malicious codes or new malware utilizing zero-day vulnerabilities. To overcome this limitation, many studies are actively carried out to classify malicious codes using N-gram. Although they can detect malicious codes with high accuracy, it is difficult to identify malicious codes that uses very short codes such as Spectre. We propose a function level N-gram comparison algorithm to effectively identify the Spectre binary. To test the validity of this algorithm, we built N-gram data sets from 165 normal binaries and 25 malignant binaries. When we used Random Forest models, the model performance experiments identified Spectre malicious functions with 99.99% accuracy and its f1-score was 92%.
참고문헌 (20)
- P. Kocher, "Spectre attacks:Exploiting speculative execution", 2019 IEEE Symposium on Security and Privacy (SP), pp.1~19 (2019)
- "Intel® 64 and IA-32Architectures Software Developer’s Manual: Volume 3"[URL]
- "Meltdown/Spectre mitigation for 4.15 and beyond"[URL]
- M. Mushtaq, "WHISPER: A Tool for Run-Time Detection of Side-Channel Attacks", IEEE Access, 8, pp.83871~83900 (2020)
- G. Marco, "SPECTECTOR: Principled detection of speculative information flows", 2020IEEE Symposium on Security and Privacy (SP), pp.1~19 (2020)
- P. F. Brown, "Class-based n-gram models of natural language", Computational linguistics, 18(4), pp.467~480 (1992)
- I. Santos, "N-grams-based File Signatures for Malware Detection", Proceedings of the 11th International Conference on Enterprise Information Systems(ICEIS), pp.317~320 (2009)
- S. Jain, "Byte leven–gram analysis for malware detection", nternational Conference on Information Processing, pp.51~59 (2011)
- E. Raff, "n investigation of byte n-gram features for malware classification", Journal of Computer Virology and Hacking Techniques, 14(1), pp.1~20 (2018)
- A. Pektas, "Proposal of n-gram based algorithm for malware classification", The Fifth International Conference on Emerging Security Information, Systems and Technologies, pp.7~13 (2011)
- B. Kang, "N-opcode analysis for android malware classification and categorization", 2016 International conference on cyber security and protection of digital services (cyber security), pp.1~7 (2016)
- A. Fog, "The Microarchitecture of Intel, AMD and VIA CPUs", ~ (2017)
- "Retpoline: a software construct for preventing branch target injection" (2018)[URL]
- "Qspectre"[URL]
- "Spectre Mitigations in Microsoft's C/C++ Compiler"[URL]
- G. Wang, "oo7: Low-overhead Defense against Spectre attacks via Program Analysis", IEEE Transactions on Software Engineering, pp.1~1 (2019)
- N. A. Simakov, "Effect of meltdown and spectre patches on the performance of HPC applications", arXiv preprint arXiv:1801.04329, ~ (2018)
- "radare2"[URL]
- S. Ertekin, "Learning on the border:active learning in imbalanced data classification", Proceedings of the sixteenth ACM conference on Conference on information and knowledge management, pp.127~136 (2007)
- N. V. Chawla, "SMOTE:synthetic minority over-sampling technique", Journal of artificial intelligence research, 16, pp.321~357 (2002)